Nov 11, 2026 — Windows Logon and Unix PAM updates

Windows Logon

Version 4.1.2.0 of the Windows Logon plugin includes these updates:

• Updated user interface. The plugin dialogs have been rebuilt with a modern UI framework and now follow the Windows system theme, including light and dark modes. Workflows are unchanged.
• Device types in the device list. Each entry in the Device list on the authentication dialog now starts with its device type, such as Akamai MFA, Phone number, Email, Security key, Authenticator, or Hardware token, so users can tell their devices apart.
• Enable or disable offline login from the authentication dialog. Users can now select Enable offline login on the authentication dialog to enable offline login at any time, even if they previously dismissed the activation dialog. Users who already enabled offline login can select Disable offline login to disable it.
• Hardware token resync at login. When a hardware token has drifted out of sync, users are now prompted to enter the next code from the token instead of being denied. The two consecutive codes resynchronize the token automatically without administrator help. For tokens that are significantly out of sync, administrators can still use extended resync.
• Improved clock tolerance for offline login. Offline login now accepts codes within the standard RFC 6238 verification window, which reduces failures caused by small clock differences between the Windows device and the authenticator app.
• Offline login lockout fix. After an offline login lockout expires, the lockout will now reset, so users get their full number of attempts again.
• Certificate revocation checking. The plugin now checks whether the Akamai MFA server certificate has been revoked. This check is only performed when the revocation server can be reached. Only certificates that are confirmed as revoked are rejected. You can turn off this check by selecting Disable certificate revocation list (CRL) check in the installer, or by passing DISABLECRL=1 during a silent install.
• New logging and privacy protections. Warnings and errors now appear in Event Viewer under Applications and Services Logs > Akamai MFA. Detailed session logs are written to %SystemDrive%\Windows\Logs\AkamaiMfaCredentialProvider\ and are removed after 30 days. Phone numbers, email addresses, IP addresses, and other personal data are masked in logs. The device list on the authentication dialog also masks phone numbers and email addresses.
• Silent install fixes. Silent installs with /quiet now apply all command-line parameters correctly.

To update, see Update your Windows Logon plugin.

Unix PAM

Version 1.3.3 of the Unix PAM integration includes this update:

• SSH client IP address for policies and reports. The integration now sends the IP address of the connecting SSH client instead of the IP address of the Linux server. Network location policies are now evaluated against the SSH client's IP address, and authentication events show that address.

To update, see Unix PAM.